topic How to Disable Auto Commit in Firewall in Next-Generation Firewall Discussions

How to Disable Auto Commit in Firewall

Ankit1Singh — Fri, 27 Oct 2023 09:54:09 GMT

Is there any way to stop Auto-Commit?

I am facing issues with one of my Palo Alto Firewall where Auto Commit keeps failing and starting again & again.

Due to BUG, it's happening, and solution is to upgrade or downgrade to another release.

Whenever I am trying to upgrade/downgrade it gives error that Auto-commit is in queue and cannot install. So, is there any way to stop auto-commit so that I can upgrade/downgrade the device?

Thanks in advance!!!!!!!

Re: How to Disable Auto Commit in Firewall

Raido_Rattameister — Fri, 27 Oct 2023 13:56:24 GMT

What is the error that autocommit fails with?

What is output of

> debug dataplane internal pdt  bcm show port status

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCcXCAW

I have seen few cases where autocommit started working after firewall was unplugged from power and plugged back in (was suggested by TAC and worked).

Re: How to Disable Auto Commit in Firewall

BPry — Fri, 27 Oct 2023 13:59:48 GMT

@Ankit1Singh,

TAC should be giving you guidance here, especially if auto-commit is restarting once it's failed. If you haven't already, I'd make sure that whoever you're working with is aware that's happening. The only way that I've ever seen that auto-start killed off is through root access.

Re: How to Disable Auto Commit in Firewall

Ankit1Singh — Fri, 27 Oct 2023 14:05:47 GMT

@Raido_Rattameister & @BPry Thanks for your input.

I have PA410 new box.

++ Tried with multiple reboot of the firewall still same issue.

++ Tried with the factory-reset, still same issue.

++ Tried to restart the process “logrcvr” still same issue.

++ Tried to restart the mgmt.-server, still same issue.

++ Inside TSF we found the process “logrcvr” keeps crashing.

Commit error below:

Management server failed to send phase 1 to client logrcvr
Commit failed
Failed to commit policy to device

I am not able to upgrade or downgrade as the moment I hit Install PAN-OS it says " commit is in queue and can not process this task.

Even From Maintenance mode I check only available image is 11.0.2-h2 which we already factory reset.

Re: How to Disable Auto Commit in Firewall

ELynner — Mon, 04 Dec 2023 19:34:11 GMT

I have the exact same issue, same model and everything, it started when i put it up on 10.1.11 this is a new box. where you able to get this resolved? i'm just trying to get this setup so i can replace the one that died in out branch.

Re: How to Disable Auto Commit in Firewall

WIA_Admin — Mon, 04 Dec 2023 22:46:19 GMT

Having the same issue on a brand-new PA-410.

Re: How to Disable Auto Commit in Firewall

slittell — Fri, 22 Dec 2023 14:10:28 GMT

Dealing with a similar issue on a 445, cert issue forced us to upgrade to 11.0.1-h1 and passive node auto-commit fails repeatedly. Thankfully the active node upgrade went fine. Keep receiving below error on auto-commit jobs. Unable to remove the application from db.

Error: Duplicate application name 'omron-fins-base'

Re: How to Disable Auto Commit in Firewall

Alerts-Tech — Fri, 05 Jan 2024 17:35:31 GMT

The issue was resolved by upgrading to the most recent version of PanOS. To be able to upgrade, you need to cancel the autocommit job with 'clear job id <>' and run the upgrade with 'request system software install version <>' at the same second, so upgrade job will be taken by fw first.

Re: How to Disable Auto Commit in Firewall

tim_mckinney — Wed, 17 Jan 2024 20:35:34 GMT

Hi,

Is this the 'fix action' ?

We're working with TAC now on an issue that's very similar...